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(57) Abstract: An apparatus and a method for monitor- 
ing and auditing activity of a legacy environment. The ap- 
paratus includes an analyzer and a mirror manager. The 
analyzer is operative to analyze intercepted packets con- 
veyed by entities in a network and to generate analyzed 
data based on information associated with at least some 
of the packets. The analyzed data is indicative of ses- 
sions. The mirror manager is responsive to the analyzed 
data for generating data representative of mirror sessions, 
each mirror session corresponding to a session. 
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